apparmor: fix unconfined user namespace restriction forced stack

Browse source

If a task is already confined by a stack the unprivileged transition
restriction on unconfined is not correctly, applied. This results in
an escape if two transitions through an unconfined profile can be
executed.

Fix this by pushing the check into the per profile label build. The
check will always be done against unconfined and result in a stack of
just the unconfined component when necessary.

Fixes: 2d9da9b188 ("apparmor: allow restricting unprivileged change_profile")
Signed-off-by: John Johansen <john.johansen@canonical.com>

...

This commit is contained in:

John Johansen 2026-05-08 22:30:07 -07:00

parent ecd4e67a28

commit 08c2f7c8d4

1 changed files with 54 additions and 26 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

80

security/apparmor/domain.c

View file